Security and Privacy

Documents contain sensitive data. They include business relationships, prices, and bank connections.
This section describes what happens to them with us.

In Summary

• Transmission is encrypted. Access to accounting (tokens and keys) is stored securely.
• Documents are separated by accounts; no one can see others' docs. Only those you invite can see the shared folder.
• Deleted means deleted, including originals — after emptying the trash or after seven days.
• We do not need a password for your accounting; the connection runs through OAuth or an API key, which you can revoke at any time.

Who Has Access to the Data

On our side, only the operator has access when resolving a reported issue. The administrator can see the list of accounts, tariffs, and the number of documents; they can access the content of documents only directly in the database and storage.

Processors

Document processing involves subcontractors:

• OpenAI — the model that reads documents. Images of pages and text of the document are sent for processing; according to the terms of its API, data is not used for training models.
• Supabase — database and login via Google.
• Cloudflare — file storage (R2) and email reception.
• Hetzner — server where the application, OCR, and document previews run.
• Stripe — payments. Telegram — bot, if you use it.
• Brevo — sending emails: morning summary, account notifications, and invitations to folders. It receives the recipient's address and email text: the number of documents, file names, folder name, API key name, webhook address, or sender. It does not receive the content of documents.

The VIES register and the ARES registry only receive DIČ, and possibly IČO or the company name.

Reporting Errors

Have you found a security flaw? Contact us before you disclose it.